./strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ./syz-executor98389074
<...>
Warning: Permanently added '10.128.0.12' (ECDSA) to the list of known hosts.
execve("./syz-executor98389074", ["./syz-executor98389074"], 0x7fffe6afb3b0 /* 10 vars */) = 0
brk(NULL) = 0x555556181000
brk(0x555556181c40) = 0x555556181c40
arch_prctl(ARCH_SET_FS, 0x555556181300) = 0
uname({sysname="Linux", nodename="syzkaller", ...}) = 0
readlink("/proc/self/exe", "/root/syz-executor98389074", 4096) = 26
brk(0x5555561a2c40) = 0x5555561a2c40
brk(0x5555561a3000) = 0x5555561a3000
mprotect(0x7efe94171000, 16384, PROT_READ) = 0
mmap(0x1ffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffff000
mmap(0x20000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x20000000
mmap(0x21000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x21000000
getpid() = 4991
mkdir("./syzkaller.qWcXWz", 0700) = 0
chmod("./syzkaller.qWcXWz", 0777) = 0
chdir("./syzkaller.qWcXWz") = 0
mkdir("./0", 0777) = 0
openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 3
ioctl(3, LOOP_CLR_FD) = -1 ENXIO (No such device or address)
close(3) = 0
clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555561815d0) = 4992
./strace-static-x86_64: Process 4992 attached
[pid 4992] chdir("./0") = 0
[pid 4992] prctl(PR_SET_PDEATHSIG, SIGKILL) = 0
[pid 4992] setpgid(0, 0) = 0
[pid 4992] openat(AT_FDCWD, "/proc/self/oom_score_adj", O_WRONLY|O_CLOEXEC) = 3
[pid 4992] write(3, "1000", 4) = 4
[pid 4992] close(3) = 0
[pid 4992] symlink("/dev/binderfs", "./binderfs") = 0
[pid 4992] memfd_create("syzkaller", 0) = 3
[pid 4992] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efe8bc96000
[pid 4992] write(3, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 1048576) = 1048576
[pid 4992] munmap(0x7efe8bc96000, 1048576) = 0
[pid 4992] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 4
[pid 4992] ioctl(4, LOOP_SET_FD, 3) = 0
[pid 4992] close(3) = 0
[pid 4992] mkdir("./file1", 0777) = 0
[ 55.689836][ T4992] memfd_create() without MFD_EXEC nor MFD_NOEXEC_SEAL, pid=4992 'syz-executor983'
[ 55.718006][ T4992] loop0: detected capacity change from 0 to 2048
[ 55.728333][ T4992] =======================================================
[pid 4992] mount("/dev/loop0", "./file1", "udf", MS_NODEV|MS_NOEXEC|MS_MANDLOCK|MS_POSIXACL, "noadinicb,utf8,adinicb,iocharset=cp865,noadinicb,") = 0
[pid 4992] openat(AT_FDCWD, "./file1", O_RDONLY|O_DIRECTORY) = 3
[pid 4992] chdir("./file1") = 0
[pid 4992] ioctl(4, LOOP_CLR_FD) = 0
[pid 4992] close(4) = 0
[ 55.728333][ T4992] WARNING: The mand mount option has been deprecated and
[ 55.728333][ T4992] and is ignored by this kernel. Remove the mand
[ 55.728333][ T4992] option from the mount to silence this warning.
[ 55.728333][ T4992] =======================================================
[ 55.766657][ T4992] UDF-fs: error (device loop0): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d
[ 55.778809][ T4992] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000)
[pid 4992] open("./bus", O_RDWR|O_CREAT|O_SYNC|O_DIRECT|O_NOATIME|FASYNC, 000) = 4
[pid 4992] mount("/dev/loop0", "./bus", NULL, MS_BIND, NULL) = 0
[pid 4992] memfd_create("syzkaller", 0) = 5
[pid 4992] mmap(NULL, 138412032, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7efe83996000
[pid 4992] write(5, "\xeb\x52\x90\x4e\x54\x46\x53\x20\x20\x20\x20\x00\x08\x02\x00\x00\x00\x00\x00\x00\x00\xf8\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x80\x00\x80\x00\xff\x03\x00\x00\x00\x00\x00\x00\x04\x00\x00\x00\x00\x00\x00\x00\xff\x00\x00\x00\x00\x00\x00\x00\xf5\x00\x00\x00\x02\x00\x00\x00\xf7\x9a\x81\x47\x2b\x73\xcf\x43\x00\x00\x00\x00\x0e\x1f\xbe\x71\x7c\xac\x22\xc0\x74\x0b\x56\xb4\x0e\xbb\x07\x00"..., 2097152) = 2097152
[pid 4992] munmap(0x7efe83996000, 2097152) = 0
[pid 4992] openat(AT_FDCWD, "/dev/loop0", O_RDWR) = 6
[pid 4992] ioctl(6, LOOP_SET_FD, 5) = -1 EBUSY (Device or resource busy)
[pid 4992] ioctl(6, LOOP_CLR_FD) = 0
[pid 4992] ioctl(6, LOOP_SET_FD, 5) = -1 EBUSY (Device or resource busy)
[pid 4992] close(6) = 0
[ 55.794999][ T27] audit: type=1800 audit(1684177352.742:2): pid=4992 uid=0 auid=4294967295 ses=4294967295 subj=_ op=collect_data cause=failed(directio) comm="syz-executor983" name="bus" dev="loop0" ino=1367 res=0 errno=0
[pid 4992] close(5) = 0
[pid 4992] open("./bus", O_RDWR|O_NOCTTY|O_SYNC|O_NOATIME|0x3c) = 5
[pid 4992] write(5, "\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00"..., 34136651) = 1048576
[pid 4992] exit_group(0) = ?
[pid 4992] +++ exited with 0 +++
--- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_EXITED, si_pid=4992, si_uid=0, si_status=0, si_utime=0, si_stime=18 /* 0.18 s */} ---
umount2("./0", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
openat(AT_FDCWD, "./0", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0700, st_size=4096, ...}) = 0
getdents64(3, 0x555556182620 /* 4 entries */, 32768) = 112
umount2("./0/binderfs", MNT_DETACH|UMOUNT_NOFOLLOW) = -1 EINVAL (Invalid argument)
lstat("./0/binderfs", {st_mode=S_IFLNK|0777, st_size=13, ...}) = 0
unlink("./0/binderfs") = 0
[ 55.992103][ T4991] ==================================================================
[ 56.000173][ T4991] BUG: KASAN: use-after-free in crc_itu_t+0x21c/0x2a0
[ 56.006929][ T4991] Read of size 1 at addr ffff88807bcd0000 by task syz-executor983/4991
[ 56.015228][ T4991]
[ 56.017530][ T4991] CPU: 0 PID: 4991 Comm: syz-executor983 Not tainted 6.4.0-rc2-syzkaller #0
[ 56.026176][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
[ 56.036216][ T4991] Call Trace:
[ 56.039477][ T4991]
[ 56.042395][ T4991] dump_stack_lvl+0x1e7/0x2d0
[ 56.047057][ T4991] ? nf_tcp_handle_invalid+0x650/0x650
[ 56.052499][ T4991] ? panic+0x770/0x770
[ 56.056553][ T4991] ? _printk+0xd5/0x120
[ 56.060692][ T4991] print_report+0x163/0x540
[ 56.065178][ T4991] ? ktime_get_real_ts64+0x460/0x460
[ 56.070444][ T4991] ? time64_to_tm+0x331/0x4d0
[ 56.075102][ T4991] ? __virt_addr_valid+0x22f/0x2e0
[ 56.080202][ T4991] ? __phys_addr+0xba/0x170
[ 56.084688][ T4991] ? crc_itu_t+0x21c/0x2a0
[ 56.089082][ T4991] kasan_report+0x176/0x1b0
[ 56.093581][ T4991] ? crc_itu_t+0x21c/0x2a0
[ 56.097978][ T4991] ? pvclock_gtod_unregister_notifier+0x50/0x50
[ 56.104202][ T4991] crc_itu_t+0x21c/0x2a0
[ 56.108435][ T4991] udf_sync_fs+0x1d2/0x380
[ 56.112839][ T4991] ? udf_put_super+0x160/0x160
[ 56.117591][ T4991] sync_filesystem+0xec/0x220
[ 56.122254][ T4991] generic_shutdown_super+0x6f/0x340
[ 56.127528][ T4991] kill_block_super+0x84/0xf0
[ 56.132188][ T4991] deactivate_locked_super+0xa4/0x110
[ 56.137542][ T4991] cleanup_mnt+0x426/0x4c0
[ 56.141944][ T4991] ? _raw_spin_unlock_irq+0x23/0x50
[ 56.147129][ T4991] task_work_run+0x24a/0x300
[ 56.151703][ T4991] ? dput+0x3a1/0x420
[ 56.155666][ T4991] ? task_work_cancel+0x2b0/0x2b0
[ 56.160675][ T4991] ? __x64_sys_umount+0x126/0x170
[ 56.165684][ T4991] ptrace_notify+0x2cd/0x380
[ 56.170259][ T4991] ? do_notify_parent+0xf50/0xf50
[ 56.175267][ T4991] ? user_path_at_empty+0x12f/0x180
[ 56.180448][ T4991] ? __x64_sys_umount+0x126/0x170
[ 56.185458][ T4991] ? path_umount+0xea0/0xea0
[ 56.190032][ T4991] ? syscall_enter_from_user_mode+0x32/0x230
[ 56.196009][ T4991] syscall_exit_to_user_mode+0x157/0x280
[ 56.201627][ T4991] do_syscall_64+0x4d/0xc0
[ 56.206032][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 56.211910][ T4991] RIP: 0033:0x7efe940e5167
[ 56.216311][ T4991] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 56.235897][ T4991] RSP: 002b:00007ffe34d28618 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 56.244298][ T4991] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007efe940e5167
[ 56.252253][ T4991] RDX: 00007ffe34d286d9 RSI: 000000000000000a RDI: 00007ffe34d286d0
[ 56.260206][ T4991] RBP: 00007ffe34d286d0 R08: 00000000ffffffff R09: 00007ffe34d284b0
[ 56.268159][ T4991] R10: 0000555556182683 R11: 0000000000000206 R12: 00007ffe34d29740
[ 56.276114][ T4991] R13: 00005555561825f0 R14: 00007ffe34d28640 R15: 0000000000000001
[ 56.284072][ T4991]
[ 56.287075][ T4991]
[ 56.289379][ T4991] The buggy address belongs to the physical page:
[ 56.295770][ T4991] page:ffffea0001ef3400 refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x7bcd0
[ 56.305907][ T4991] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[ 56.312997][ T4991] page_type: 0xffffffff()
[ 56.317311][ T4991] raw: 00fff00000000000 ffffea0001d3e948 ffffea0001ef29c8 0000000000000000
[ 56.325877][ T4991] raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
[ 56.334439][ T4991] page dumped because: kasan: bad access detected
[ 56.340828][ T4991] page_owner tracks the page as freed
[ 56.346173][ T4991] page last allocated via order 0, migratetype Movable, gfp_mask 0x140dca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_ZERO), pid 4983, tgid 4983 (sshd), ts 50187369460, free_ts 50194202325
[ 56.364125][ T4991] post_alloc_hook+0x1e6/0x210
[ 56.368877][ T4991] get_page_from_freelist+0x321c/0x33a0
[ 56.374411][ T4991] __alloc_pages+0x255/0x670
[ 56.378983][ T4991] __folio_alloc+0x13/0x30
[ 56.383382][ T4991] vma_alloc_folio+0x48a/0x9a0
[ 56.388129][ T4991] handle_mm_fault+0x2942/0x5860
[ 56.393050][ T4991] exc_page_fault+0x274/0x910
[ 56.397912][ T4991] asm_exc_page_fault+0x26/0x30
[ 56.402932][ T4991] page last free stack trace:
[ 56.407598][ T4991] free_unref_page_prepare+0x903/0xa30
[ 56.413050][ T4991] free_unref_page_list+0x596/0x830
[ 56.418238][ T4991] release_pages+0x2193/0x2470
[ 56.422992][ T4991] tlb_flush_mmu+0x100/0x210
[ 56.427575][ T4991] tlb_finish_mmu+0xd4/0x1f0
[ 56.432155][ T4991] unmap_region+0x258/0x2a0
[ 56.436645][ T4991] do_vmi_align_munmap+0x1123/0x1820
[ 56.441915][ T4991] do_vmi_munmap+0x24a/0x2b0
[ 56.446486][ T4991] __vm_munmap+0x226/0x470
[ 56.450887][ T4991] __x64_sys_munmap+0x69/0x80
[ 56.455546][ T4991] do_syscall_64+0x41/0xc0
[ 56.459949][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 56.465825][ T4991]
[ 56.468131][ T4991] Memory state around the buggy address:
[ 56.473740][ T4991] ffff88807bccff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 56.481780][ T4991] ffff88807bccff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 56.489819][ T4991] >ffff88807bcd0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 56.497855][ T4991] ^
[ 56.501905][ T4991] ffff88807bcd0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 56.509942][ T4991] ffff88807bcd0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 56.517980][ T4991] ==================================================================
[ 56.526260][ T4991] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 56.533454][ T4991] CPU: 1 PID: 4991 Comm: syz-executor983 Not tainted 6.4.0-rc2-syzkaller #0
[ 56.542130][ T4991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023
[ 56.552169][ T4991] Call Trace:
[ 56.555432][ T4991]
[ 56.558348][ T4991] dump_stack_lvl+0x1e7/0x2d0
[ 56.563024][ T4991] ? nf_tcp_handle_invalid+0x650/0x650
[ 56.568469][ T4991] ? panic+0x770/0x770
[ 56.572526][ T4991] ? preempt_schedule_common+0x83/0xc0
[ 56.577973][ T4991] ? vscnprintf+0x5d/0x80
[ 56.582292][ T4991] panic+0x30f/0x770
[ 56.586171][ T4991] ? check_panic_on_warn+0x21/0xa0
[ 56.591271][ T4991] ? __memcpy_flushcache+0x2b0/0x2b0
[ 56.596540][ T4991] ? _raw_spin_unlock_irqrestore+0x12c/0x140
[ 56.602504][ T4991] ? _raw_spin_unlock+0x40/0x40
[ 56.607337][ T4991] check_panic_on_warn+0x82/0xa0
[ 56.612261][ T4991] ? crc_itu_t+0x21c/0x2a0
[ 56.616659][ T4991] end_report+0x63/0x110
[ 56.620889][ T4991] kasan_report+0x183/0x1b0
[ 56.625380][ T4991] ? crc_itu_t+0x21c/0x2a0
[ 56.629782][ T4991] ? pvclock_gtod_unregister_notifier+0x50/0x50
[ 56.636011][ T4991] crc_itu_t+0x21c/0x2a0
[ 56.640237][ T4991] udf_sync_fs+0x1d2/0x380
[ 56.644644][ T4991] ? udf_put_super+0x160/0x160
[ 56.649396][ T4991] sync_filesystem+0xec/0x220
[ 56.654057][ T4991] generic_shutdown_super+0x6f/0x340
[ 56.659326][ T4991] kill_block_super+0x84/0xf0
[ 56.663990][ T4991] deactivate_locked_super+0xa4/0x110
[ 56.669345][ T4991] cleanup_mnt+0x426/0x4c0
[ 56.673746][ T4991] ? _raw_spin_unlock_irq+0x23/0x50
[ 56.678927][ T4991] task_work_run+0x24a/0x300
[ 56.683498][ T4991] ? dput+0x3a1/0x420
[ 56.687462][ T4991] ? task_work_cancel+0x2b0/0x2b0
[ 56.692477][ T4991] ? __x64_sys_umount+0x126/0x170
[ 56.697488][ T4991] ptrace_notify+0x2cd/0x380
[ 56.702064][ T4991] ? do_notify_parent+0xf50/0xf50
[ 56.707069][ T4991] ? user_path_at_empty+0x12f/0x180
[ 56.712251][ T4991] ? __x64_sys_umount+0x126/0x170
[ 56.717258][ T4991] ? path_umount+0xea0/0xea0
[ 56.721855][ T4991] ? syscall_enter_from_user_mode+0x32/0x230
[ 56.727833][ T4991] syscall_exit_to_user_mode+0x157/0x280
[ 56.733457][ T4991] do_syscall_64+0x4d/0xc0
[ 56.737878][ T4991] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 56.743766][ T4991] RIP: 0033:0x7efe940e5167
[ 56.748170][ T4991] Code: 09 00 48 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48
[ 56.767775][ T4991] RSP: 002b:00007ffe34d28618 EFLAGS: 00000206 ORIG_RAX: 00000000000000a6
[ 56.776186][ T4991] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 00007efe940e5167
[ 56.784148][ T4991] RDX: 00007ffe34d286d9 RSI: 000000000000000a RDI: 00007ffe34d286d0
[ 56.792112][ T4991] RBP: 00007ffe34d286d0 R08: 00000000ffffffff R09: 00007ffe34d284b0
[ 56.800084][ T4991] R10: 0000555556182683 R11: 0000000000000206 R12: 00007ffe34d29740
[ 56.808058][ T4991] R13: 00005555561825f0 R14: 00007ffe34d28640 R15: 0000000000000001
[ 56.816025][ T4991]
[ 56.819177][ T4991] Kernel Offset: disabled
[ 56.823488][ T4991] Rebooting in 86400 seconds..